Medical Aesthetics & BeautyContact Us

Privacy Policy

Last updated: October 2026

1. Introduction

SkinSpirit ("we", "us", "our") is committed to protecting your personal information in accordance with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). This policy explains how we collect, use, disclose, and safeguard your information.

2. Information We Collect

We may collect the following personal information:

  • Booking information: Name, email, phone number, and appointment details collected through our Square booking system.
  • Enquiries and quiz follow-up: Contact details and the information you choose to submit through our enquiry forms or Skin Quiz.
  • Newsletter subscriptions: Email address when you subscribe to our mailing list.
  • Payment information: Payment details processed securely through Square. We do not store credit card numbers on our servers.
  • Treatment records: Health and treatment history relevant to your services, particularly for medical aesthetic treatments.
  • Website usage: Anonymous analytics data collected via Vercel Analytics.
  • First-party campaign attribution: For marketing enquiries, we may record the landing and submission pages, the previous page on our website where available, timestamps, an external referrer domain and path supplied by the browser, and allowlisted campaign tags such as UTM values or common advertising click IDs. We do not use this feature to collect IP addresses, create device fingerprints, retain arbitrary query parameters, or place health information into analytics tags.

3. How We Use Your Information

We use your personal information to:

  • Process and manage your bookings
  • Provide and personalise our services
  • Send appointment confirmations and reminders
  • Send newsletters and promotional communications (with your consent)
  • Process payments securely
  • Understand which campaigns and referral sources generate enquiries, assess campaign effectiveness, and improve our website and services
  • Comply with legal obligations

4. Third-Party Services

We use the following third-party services that may process your data:

  • Square: For appointment bookings, payment processing, and customer management. Square's privacy policy applies to data processed through their platform.
  • Vercel: For website hosting and analytics. Vercel collects anonymous usage data to help us improve site performance.
  • Google: Google Analytics helps us understand website usage, and Google Tag Manager manages our website measurement tags.
  • Meta: Website measurement tags help us measure visits and advertising performance. Meta may receive page URLs, browser and device information, IP addresses and advertising cookie identifiers. We do not configure these tags to send enquiry form contents, Skin Quiz answers or patient records, and automatic customer-details matching is disabled. For direct bookings, if you opt in, we send generic confirmed booking and successful payment events, the actual amount and currency, and browser advertising identifiers. We exclude treatment names, appointment times, contact details and health information from these events.

5. Cookies and Local Storage

Our website uses essential cookies required for site functionality. We also use first-party browser local storage to remember enquiry campaign attribution for up to 30 days, including separate first-touch and last-touch records. This information is sent to SkinSpirit only if you submit an enquiry or Skin Quiz lead form. If local storage is unavailable, the form still works and attribution may be limited to the current browser session or shown as unknown. Vercel Analytics collects anonymous performance data. This first-party enquiry attribution is separate from our advertising measurement. Meta tags may use advertising cookies to associate website visits with ads and Meta accounts. You can control cookies through your browser settings and advertising preferences through your Meta account.

6. Data Security

We take reasonable steps to protect your personal information from misuse, interference, loss, and unauthorised access. Payment information is processed securely through Square's PCI-compliant infrastructure.

7. Data Retention

First-party campaign attribution stored in your browser expires after 30 days. Attribution included with an enquiry notification is retained with that enquiry only for as long as reasonably necessary to respond, evaluate campaign performance, meet operational needs, or comply with law. Other personal information is retained only for as long as necessary for the purpose for which it was collected, or as required by law. You may request deletion of your data at any time.

8. Your Rights

Under the Australian Privacy Act, you have the right to:

  • Access the personal information we hold about you
  • Request correction of inaccurate information
  • Request deletion of your personal information
  • Opt out of marketing communications at any time
  • Lodge a complaint with the Office of the Australian Information Commissioner (OAIC)

9. Contact Us

If you have questions about this privacy policy or wish to exercise your rights, please contact us: